nerdexam
(ISC)2

CISSP · Question #1235

Before allowing a web application into the production environment, the security practitioner performs multiple types of tests to confirm that the web application performs as expected. To test the…

The correct answer is A. Misuse case testing. The security practitioner is deliberately entering invalid or excessive input into a field to test how the application handles unexpected or abusive usage, which is the definition of misuse case testing.

Submitted by brentm· Mar 5, 2026Software Development Security

Question

Before allowing a web application into the production environment, the security practitioner performs multiple types of tests to confirm that the web application performs as expected. To test the username field, the security practitioner creates a test that enters more characters into the field than is allowed. Which of the following BEST describes the type of test performed?

Options

  • AMisuse case testing
  • BPenetration testing
  • CWeb session testing
  • DInterface testing

How the community answered

(24 responses)
  • A
    75% (18)
  • B
    4% (1)
  • C
    17% (4)
  • D
    4% (1)

Why each option

The security practitioner is deliberately entering invalid or excessive input into a field to test how the application handles unexpected or abusive usage, which is the definition of misuse case testing.

AMisuse case testingCorrect

Misuse case testing (also called abuse case testing) involves deliberately providing invalid, unexpected, or malicious inputs to verify that an application handles them securely and gracefully. Entering more characters than allowed in a username field is a classic misuse case scenario designed to test boundary conditions and potential buffer overflow or input validation vulnerabilities. This type of testing specifically models how an attacker or malicious user might misuse the application's intended functionality.

BPenetration testing

Penetration testing is a broader, structured methodology that simulates a full attack against a system to find exploitable vulnerabilities, not a specific test of a single input field's boundary conditions.

CWeb session testing

Web session testing focuses on evaluating session management mechanisms such as session tokens, cookies, timeouts, and session fixation - not input field validation or boundary testing.

DInterface testing

Interface testing verifies that components or systems interact and communicate correctly with each other (e.g., APIs, UI elements), not that individual input fields handle excessive or invalid data appropriately.

Concept tested: Misuse case and input boundary testing in web applications

Source: https://owasp.org/www-community/Fuzzing

Topics

#Misuse case testing#Security testing#Web application testing#Software quality assurance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISSP Practice